PEE Submission to ICO Age-Appropriate Design Code 


RE: ICO Age-Appropriate Design Code 


1a Please provide any views or evidence you have on how appropriate you consider the 
above age brackets would be of setting design standards for the processing of children’s 
personal data by providers of ISS (online services) 


My response to these age brackets (not at all appropriate) is in relation to the specific issue 
of processing of children’s personal data for the purposes of marketing including 
behavioural marketing. 


My expertise lies particularly in the area of marketing of foods and non-alcoholic beverages. 
Unhealthy foods may not be advertised to children by broadcast media in the UK as the 
potential for harm has already been established by multiple international systematic 
reviews and subsequent experimental research. 


Here, | highlight issues relating to design standards for the processing of children’s personal 
data by providers of ISS (online services) that facilitate the targeted, behavioural marketing 
of unhealthy food items not permitted in other media. 


Not only does such marketing expose children to greater risks as their use of digital 
compared to broadcast media increases, but the techniques made possible as a result of 
personal data processing have the potential to target those children most susceptible to 
these marketing messages. These include not only content, design and targeting but also 
the widespread sharing of such messages among peers, giving them wider reach and 
currency. This is because 


- Digital media allow for personalized ‘micro-targeting’ of marketing messages — 
reaching those most vulnerable to their effects 

- Digital media allow for ever-evolving novel, creative approaches (such as games, peer 
photo and video sharing, and many other strategies) that create immersive, engaging 
techniques, magnifying the appeal of marketing to children. 
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- The ‘privacy’ data use provisions adopted by digital media service providers allow 
them to extract users’ data, draw inferences from them, experiment with them 
constantly, and analyse responses instantaneously. 


For these reasons, all children under 18 years as defined by the UNCRC should be protected 
from such data extraction and marketing practices. 


Needless to say, the data processing issues in this field affect children’s well-being more 
beyond this area of unhealthy food marketing alone, and for many of these issues | would 
like to endorse the extensive submission of the 5Rights group to this consultation. 


The brief summaries in this submission are drawn from the following sources. J 


Garde, A. & Tatlow-Golden, M. (forthcoming, 2019). Digital food marketing and children’s rights. In State of 
the World’s Children: Children, food & nutrition [Titles TBC]. Geneva: UNICEF 

The World Health Organization Regional Office for Europe (forthcoming, October 2018). Evaluating 
implementation of the WHO Set of Recommendations on the marketing of foods and non-alcoholic 
beverages to children. Progress, challenges and guidance for next steps in the WHO European Region 

The World Health Organization Regional Office for Europe (November 2016). Tackling food marketing to 
children in a digital world: trans-disciplinary perspectives. Children’s rights, evidence of impact, 
mesodologicas challenges, regulatory options and policy implications for the WHO European Region. 


digital- -world-trans-disciplinary-perspectives-en.pdf 

Tatlow-Golden, M. with Tracey, L. & Dolphin, L. (June 2016). Who’s feeding the kids online? Digital food 
marketing to children in Ireland: Advertisers’ tactics, children’s exposure and parents’ awareness. 
Dublin: Irish Heart Foundation. https://irishheart.ie/wp- 
content/uploads/2016/12/web__whos_feeding_the _kids_online_report _2016.compressed.pdf 


2 Please provide any views or evidence about children’s development needs in an online 
context for each, or any of the above age brackets. 


| address this below in responding to Q4 regarding transparency of paid-for activity; terms & 
conditions/privacy notices; default privacy settings and other issues. 


3 Please provide any views or evidence you have on how the Convention might apply in 
the context of setting design standards for the processing of children’s personal data by 
providers of ISS (online services) 


The UNCRC mandates that children (aged under 18) enjoy both participation and protection 
rights, including in the digital environment, and should be supported by States in doing so 
(WHO, 2016) 


“An overarching principle of the United Nations Convention on the Rights of the Child is 
that, in actions concerning children, the best interests of the child are a primary 
consideration (Art. 3). The Convention articulates children’s rights to both participation and 
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protection, and the digital environment is no exception. Children’s participation rights 
include freedom of expression (Art. 13), freedom of association (Art. 14) and access to 
information and the mass media (Art. 17). In addition to information and media access, 
Article 17 also encourages States to develop “appropriate guidelines for the protection of 
the child from information and material injurious to his or her well-being”. Furthermore, 
under the Convention, children enjoy protection rights, such as rights to health (Art. 24), 
privacy (Art. 16) and protection from economic exploitation (Art. 32). The Convention on the 
Rights of the Child stipulates that these rights must be effectively protected (Art. 4), citing 
parental responsibility to nurture children (Art. 5), but importantly also invoking States’ 
responsibility to protect and assist families in doing so (Art. 18)” (WHO, 2016). Furthermore, 
children’s right to privacy is also affected by the practices of behavioural marketing (Garde 
& Tatlow-Golden, UNICEF, 2019) 


4 Please provide any views or evidence you have on what you think the Information 
Commissioner should take into account when explaining the meaning and coverage of 
these terms in the Code? 


Transparency of paid-for activity such as product placement and marketing 

The assumption here is that advertising literacy (recognising that an ad is an ad and that it is 
trying to persuade a child) can support children in resisting such advertising. However, this 
approach is not supported by studies of advertising literacy — which take an information- 
based approach unequal to the highly engaging, emotion-focused, entertaining marketing 
that children of all ages encounter in digital media and there is no evidence that this form of 
marketing can be resisted through cognitive knowledge, however well-developed (WHO, 
2016; Garde & Tatlow-Golden in UNICEF, 2019). 


The presentation and language of terms and conditions and privacy notices 

It is a concern that this term implies that children will, after appropriate language and 
design adjustments, be in a position to give informed consent to the use of their data. 
Although very young children can understand complex concepts, it is highly unlikely that 
children under approximately 16 years of age can, developmentally, grasp the long-term 
consequences of data use, sale, resale, profiling, and the potential harms that ensue and 
therefore their consent cannot be considered to be informed. 


Furthermore, from a developmental perspective, adolescents who may be able to 
understand long-term implications, are likely to be under peer pressure to join certain sites, 
so even when an evolved capacity for critical literacy allows for a certain kind of 
comprehension, other psychosocial developmental factors may override this. 


Indeed, this is difficult at present for most well-informed adults, given the opacity of 
information that platforms give — but also because consent, even if informed cannot be 
freely given, as most major platforms do not offer non-targeting options, and yet have 
become sites on which community, education and other resources are housed, as well as 
much social life. (WHO, 2016; Garde & Tatlow-Golden in UNICEF, 2019) 
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Default privacy settings; data minimisation standards; uses of geolocation technology; 
automated and semi-automated profiling; the sharing and resale of data 

Currently, data extracted from children by ISS (online services), whatever purposes these 
are stated to be for originally, are frequently sold, and are used to profile children and draw 
inferences about them. This brings risks of immediate, shorter-term harms, such as more 
precise targeting of products/brands for items detrimental to health. It also brings the risk 
of long-term disadvantage, over which children and parents have little if no control. The 
issues go to privacy; to health but also beyond it to other potential harms such as equitable 
access to opportunities, employment etc. (WHO, 2016; Garde & Tatlow-Golden in UNICEF, 
2019). 


Under these conditions, geolocation, use of facial recognition and mood/personality 
prediction, profiling, and sale of data should all be prohibited. At the very least, default 
privacy settings to ‘private’ should be required for under-18s. Note also Recommendation 
37 in the Council of Europe’s Recommendation CM/Rec(2018)7 of the Committee of 
Ministers to member States on Guidelines to respect, protect and fulfil the rights of the 
child in the digital environment 
https://search.coe.int/cm/Pages/result_details.aspx?ObjectID=09000016808b79f7 


Should the ICO wish any further information regarding these documents including further 
summaries of their content | would be very happy to supply these 


With kind regards 


